The vulnerability is an improper neutralization of input during web page generation that allows stored cross‑site scripting. Injected script characters are persisted by the WP REST Cache plugin and later rendered to any visitor, enabling client‑side compromise such as code execution, defacement, or session hijacking. This weakness is classified as CWE‑79.

Acato’s WP REST Cache plugin for WordPress is affected for every release up through and including 2026.1.0. If the plugin is installed on a site, site administrators should verify the installed version and plan to upgrade to a patched release released after 2026.1.0; later versions are considered safe.

The CVSS score of 7.1 denotes high severity. Because the EPSS score is unavailable and the issue is not listed in CISA’s KEV catalog, the likelihood of exploitation is uncertain, yet the stored nature of the flaw means any user who views affected content is vulnerable. Based on the description, it is inferred that an attacker could deliver malicious payloads through any input field that the plugin accepts and stores without sanitization, which would then be executed in the browsers of subsequent readers.